Difference between revisions of "User talk:Jeff Williams"

Latest revision as of 19:53, 5 November 2009

@@ Line 1: / Line 1: @@
-{{#widget:MyWeather
-|zipcode=73135
-|title=Weather in Oklahoma City
-}}
-;Injecting DOWN:The less common way to perform XSS injection is to introduce a code subcontext without closing the current context. For example, if you change &lt;img src="...UNTRUSTED DATA HERE..." /> to &lt;img src="javascript:alert(1)" /> you do not have to escape the HTML attribute context.  Instead, you introduce context that allows scripting within the src attribute. Another example is the expression() functionality in CSS properties. Even though you may not be able to escape a quoted CSS property to inject up, you may be able to introduce something like xss:expression(document.write(document.cookie)) without ever leaving the current context.
+&lt;img src="javascript:alert(1)" />